Method and home gateway for detecting machines infected by domain generating algorithms

Abstract

The invention relates to a method for detecting machines infected by domain generating algorithms (DGA) from a home gateway (1) connected to a local network, at least one device (2) being connected to the home gateway via the local network, the method comprising the following steps: - monitoring domain name traffic, - selecting a domain name, - if the domain name selected does not exist in a database (19):- allocating a weight to the selected domain name, - automatically processing the domain name selected by a DGA detection model defining a score for the at least one connected device according to a weight allocated to the selected domain name and an infection probability for the selected domain name, the device being considered to be infected when the score of the connected device is less than a predetermined score.

Description

[0001] DESCRIPTION

[0002] TITLE: Method and home gateway for detecting infected machines using domain generation algorithms

[0003] Technical field

[0004] The present invention relates to a method for detecting machines infected by domain generation algorithms. It also relates to a home gateway for detecting machines infected by domain generation algorithms.

[0005] State of the prior art

[0006] Modern botnets and malware represent one of the biggest threats to information security due to their rapid growth in size and sophistication. These malicious applications use a command and control server (also known as a C&C server) to manage bots and execute commands remotely to perform malicious activities.

[0007] In contrast to traditional malware detection measures such as reverse engineering or static blacklisting, these malicious applications use domain name generation algorithms (DGA). This DGA approach is very robust against blacklisting and difficult to detect using traditional approaches given the large number of possible domain names generated.

[0008] Today, the challenge of detecting these algorithms is one of the important axes of defense in cyber security.

[0009] One of the solutions that has been adopted in recent years is the model-based approach of "machine learning". There are several "machine learning" approaches in the literature to solve this problem, categorized into two groups according to the speed of detection: real-time approaches and retrospective approaches.

[0010] These models have shown their robustness against DGA algorithms, but the manual choice of characteristics in classic models opens the door to several vulnerabilities, such as adversarial attacks to circumvent detection (use of dictionary words in malicious domain names that are difficult to detect), or the risk of blocking non-malicious sites even by non-classic models ("deep learning"). In addition, the majority of models published in research are based on a remote server approach (also called "cloud") which induces latency during detection. This latency is due to the transfer delay between the DNS server and the server deploying the detection model.

[0011] The aim of the present invention is to solve at least one of these drawbacks with a new method for detecting machines infected by domain generation algorithms.

[0012] Statement of the invention

[0013] This objective is achieved with a method for detecting infected machines by domain generation algorithms (DGA) from a home gateway connected to a local network, at least one device being connected to the home gateway via the local network. According to the invention, the home gateway comprises a database, the database comprising a list of infected domain names, the method comprising the following steps:

[0014] - monitoring of domain name traffic on the local network,

[0015] - selection of a domain name in domain name traffic,

[0016] - if the selected domain name is included in the said list, the list being included in the database, allocation of a maximum weight to the said selected domain name,

[0017] - if the selected domain name is not included in the database, automatic processing of the selected domain name by a detection model of the domain generation algorithms: the model assigning a weight to said selected domain name corresponding to a probability of infection only if the selected domain name is recognized as infected by the model,

[0018] - calculation of a score of at least one connected device based on the weight assigned to the selected domain name,

[0019] - updating the score of the at least one connected device based on the domain names processed by the model, the at least one device being considered infected by a domain generation algorithm when the score of said connected device is higher than a predetermined score.

[0020] The process works at the infected machine level, meaning it detects the infected device using a deep learning DGA detection model. The process's score calculation tolerates model errors because detection is done at the machine level and not at the domain name level, which avoids blocking access to non-malicious websites in the event of an error and allows for maintaining the flexibility of detecting infected devices.

[0021] Since DGA models generate too many NXDOMAINs, only a few malicious or infected domain names are considered valid. "Valid" means that the domain name query (DNS) has a valid response, i.e., the domain name is registered in the requested DNS server. These domain names considered valid are useful for connecting to the attacker's command and control server. Based on this fact, the method according to the invention uses the model only when the DNS response is NXDOMAIN or SERVERFAIL, i.e., the method only processes NXDOMAINs to avoid overloading the home gateway with calculations. However, this is still sufficient for calculating the score of the potentially infected connected device.

[0022] The model is based on recurrent neural networks, specifically LSTM (long short term memory). This architecture does not require hand-crafted features that take a long time to design and are easy to bypass. The model only takes the domain name as input, which guarantees a speed of execution allowing it to analyze multiple DNS queries in a short time, unlike other classic machine learning models.

[0023] Another advantage of such a model is that it is scalable to be trained on a large volume of data allowing it to better detect multiple DGA families and generalize to deal with adversarial attacks. Attack detection is done without using another model.

[0024] Advantageously, the maximum weight assigned to the selected domain name is equal to one because the selected domain name is certainly considered infected, it being recorded in the list of infected domain names included in the database.

[0025] Also advantageously, the weight assigned to the selected domain name that is processed by the model is less than one.

[0026] Automatic processing of the domain name selected by the model may include the following steps: - extraction of at least one characteristic of the selected domain name,

[0027] - calculation of a probability of infection of the selected domain name from at least one extracted characteristic.

[0028] Advantageously, the model extracts several features from the selected domain name using an embedded layer. This is a matrix that the model automatically learns during training to highlight the common aspects between malicious and non-malicious domain names. The input of this matrix is ​​the vectorized domain name (in encrypted mode, each letter is replaced by an integer). The output of this matrix corresponds to a vector that contains weights that characterize the domain name. For example, domain names that are similar will have two very close vectors. This vector then passes through other layers to calculate the probability of infection (the weights of these layers are also learned during model training to highlight the linear and non-linear relationships that link the characters of the domain name and whether it is malicious or not).

[0029] The features correspond to the output of the embedded layer, i.e.: domain name embedded layer (matrix) * (numeric vector) = feature (another numeric vector).

[0030] The database may also include:

[0031] - a list of devices that have already accessed the selected domain name,

[0032] - a list of domain names considered uninfected,

[0033] - a historical list of domain names considered infected by the model.

[0034] The database can then include domain names previously identified by the model as infected, their weight, and the devices that have tried to access them. If the device under study has already accessed this domain name, there is no need to update the final score of said device because the domain name has already been used to update the score of the connected device.

[0035] The selected domain name may not be included in the database if:

[0036] - the selected domain name is not considered infected in the database, - the domain name does not belong to the list of domain names considered uninfected in the database,

[0037] - the domain name does not belong to the historical list of domain names considered infected by the pattern in the database.

[0038] If a domain name is not considered infected by the model, i.e. the domain name belongs to the list of domain names considered uninfected in the database or the model considers after processing that the domain name has a probability of infection lower than the predetermined infection threshold, no weight is assigned to it. In this case, the score of the at least one connected device is not updated.

[0039] Advantageously, the score of the at least one connected device can be initialized to 50.

[0040] The selected domain name can be marked as a product of domain generation algorithms if the infection probability of said selected domain name is higher than a predetermined infection threshold. The predetermined infection threshold is variable according to the needs of each home gateway. The infection probability is used to define the weight assigned to the domain name processed by the model. For example, if the predetermined infection threshold is equal to 0.7, the weight assigned to the corresponding domain name is equal to the calculated infection probability, which is between 0.7 and 1.

[0041] If the model considers after processing that the domain name has a probability of infection lower than the predetermined infection threshold, no weight is assigned to it. In this case, the score of the at least one connected device is not updated.

[0042] The predetermined infection threshold varies according to the needs of each home gateway. If the need is to detect the maximum number of domain names generated by DGAs with a tolerance of precision (i.e., a few benign domains are considered DGAs), a low threshold around 0.7 is used for example. If the need is to detect domain names generated by DGAs with high precision (i.e., with certainty), a higher threshold is used, greater than or equal to 0.9 for example.

[0043] The selected domain name can be saved in the database along with its weight when it is marked as a product of domain generation algorithms. The selected domain name is saved in the database with its weight so that it can be used by other connected devices during the verification steps without using the model.

[0044] Advantageously, a second infection probability may be calculated during the automatic processing of the selected domain name by a detection model of the domain generation algorithms, the second infection probability corresponding to the probability of infection by an adversary attack.

[0045] If the probability of infection of said selected domain name is lower than a predetermined infection threshold, comparison of the second probability of infection to a second predetermined infection threshold:

[0046] - if the second infection probability is higher than the second predetermined infection threshold, the selected domain name is marked as an adversary attack,

[0047] - if the second infection probability is lower than the second predetermined infection threshold, the selected domain name is not marked as an adversary attack.

[0048] The model has an architecture that copes with adversarial attacks through multiple output and a custom loss function that is designed for this.

[0049] An alert can be sent to the user by the home gateway when at least one connected device is considered infected by a domain generation algorithm.

[0050] Advantageously, a performance level of the model can be calculated via a monitor component, the model being able to be updated if the performance level falls below a predetermined performance level.

[0051] The detection model of domain generation algorithms can be updated in a remote server to which the home gateway is connected.

[0052] This approach has the advantage of offering speed of execution and security because the execution of the model is done in the home gateway and the connection with the remote server is only necessary for updating the model.

[0053] According to a second aspect of the invention, a domestic gateway is proposed for detecting machines infected by domain generation algorithms, the gateway being equipped with a processing unit for implementing the steps of the method according to the invention.

[0054] According to a third aspect of the invention, a computer program product is provided comprising instructions which, when the program is executed by a computer, cause the latter to implement the steps of the method according to the invention.

[0055] Description of figures and embodiments

[0056] Other advantages and particularities of the invention will appear on reading the detailed description of implementations and embodiments which are in no way limiting, and the following appended drawings:

[0057] [Fig. 1] illustrates an example of arrangement of devices within a home, [Fig. 2] graphically illustrates the operation of the embedded DGA model according to the invention,

[0058] [Fig. 3] illustrates an on-board detection system according to the invention,

[0059] [Fig. 4] illustrates an example of a score calculation function based on the number of domain name detections generated by DGAs.

[0060] These embodiments being in no way limiting, it will be possible in particular to consider variants of the invention comprising only a selection of characteristics described or illustrated subsequently isolated from the other characteristics described or illustrated (even if this selection is isolated within a sentence comprising these other characteristics), if this selection of characteristics is sufficient to confer a technical advantage or to differentiate the invention compared to the state of the prior art. This selection comprises at least one preferably functional characteristic without structural details, and / or with only a part of the structural details if this part only is sufficient to confer a technical advantage or to differentiate the invention compared to the state of the prior art.

[0061] Generally, each home is equipped with a home gateway 1. The home gateway 1 is placed in the user's living room for example. The home gateway 1 is connected to a local network as shown in Figure 1. Different devices 2 are connected to the home gateway 1 via the local network as shown in Figure 1. The connection of the different devices 2 of the home with the home gateway 1 via the local network is either wired or wireless. The method for detecting infected machines by domain generation algorithms (DGA) according to the invention is integrated into the home gateway 1.

[0062] We will now describe, with reference to Figure 2, the operation of the embedded DGA model according to the invention. The DGA detection model 5 is implemented in an embedded application 3 of the home gateway 1 which comprises an embedded platform 4 for machine learning inference. The embedded platform 4 executes the model but also implements other functionalities to ensure the proper operation of the DGA model 5 over time.

[0063] The first function needed to run the DGA 5 detection model in embedded mode is the inference part using a suitable execution manager 7 (also called “runtime”).

[0064] The second function needed for the execution of the model 5 is the feature engineering part 6 where the data transformation is rewritten into native code of the home gateway system environment 1. The result of this feature engineering 6 is a feature vector of each domain name which is given as input to the model to send a prediction as output.

[0065] There are two ways to run a model, either through an execution manager 7 or by generating code. Using an execution manager 7 is more flexible because it allows multiple models to be run with the same duration 8. The execution manager 7 ensures that the latest version of the DGA model 5 is available, via the Embedded Model Registry 9.

[0066] If the DGA model 5 is not up to date, it is updated in a remote server 13. Since the DGA model is not an online algorithm and is trained in a remote server and not in the home gateway, it is necessary to have a way to update the models. This is necessary because the performance may suffer a degradation with the appearance of new DGA families and / or new adversarial attacks. This update function is independent of the update of the home gateway 1 system because the life cycle of the models is independent of that of the home gateway 1 system.

[0067] Model Registry 9 is responsible for storing the model files in Home Gateway 1 on the file system and it is also responsible for deleting obsolete versions of the DGA model that are no longer up to date without the need to update the firmware of Home Gateway 1. Database 14 here is part of Model Registry 9.

[0068] The Model Downloader 10 downloads models from the Model Registry 9 via a communication protocol. Since model updates occur rarely, and these are only static files, this functionality is implemented with an HTTP-based protocol. This allows leveraging the operators' CDN infrastructure.

[0069] Once the DGA 5 model is available, the execution manager 7 initializes the duration 8. Only when all these conditions are met, the execution manager 7 informs the client that the model is ready to be used for the detection of malicious domain names.

[0070] Another feature available on the embedded platform 4 is monitoring of the DGA 5 model. Indeed, monitoring the behavior of the DGA 5 model is the only way to evaluate its performance, and possibly trigger retraining. The DGA 5 model is monitored via a monitor 11.

[0071] The monitor 11 corresponds to a probe that sends test metrics to the remote server 12 to update the model if there is a drop in performance. For this, a performance level is calculated and compared to a predetermined performance level.

[0072] The metrics are based on some test malicious domain names in the home gateway 1. The DGA model is tested regularly and sends the metrics to the remote server 12. The metrics correspond to the following different rates: true positive rate, true negative rate, false negative rate, false positive rate where positive means infected by DGA, and negative means not infected by DGA.

[0073] Additionally, the template may have associated settings. In this case, the associated settings can be changed without needing to change the template, nor update the firmware of the Home Gateway 1.

[0074] We will now describe, with reference to Figure 3, an on-board detection system according to the invention.

[0075] The on-board detection system 15 in the home gateway 1 comprises the on-board platform 4, a database 19, a scoring system 16 comprising a DGA detection system 17 and a means of counting the scores 18.

[0076] When the model is ready for use, the DGA detection system 17 in which the method is implemented, calls upon said DGA model via the on-board platform 4.

[0077] The method monitors domain name traffic on the local network and in particular queries whose response is equal to NXDOMAIN or SERVFAIL indicating that the domain is generally produced by a DGA domain generation algorithm. A domain name is selected from the domain name traffic by the home gateway 1.

[0078] Database 19 includes:

[0079] - a list of domain names considered infected,

[0080] - a list of devices that have already accessed the selected domain name,

[0081] - a list of domain names considered uninfected and already verified,

[0082] - a historical list of domain names considered infected by the model.

[0083] Database 19 also includes the weights assigned to domain names considered infected in the various lists included in the database.

[0084] The process checks the database 19 to see if the selected domain name is already considered infected or malicious.

[0085] The method then checks in the database 19 whether the device 2 connected to the home gateway 1 has already tried to access this selected domain name before or not.

[0086] The method checks whether the selected domain name matches a domain name that is considered uninfected. By "considered uninfected," we mean that the domain name has previously been identified as not a DGA product. And finally, the method checks whether the domain name belongs to the historical list of domain names considered infected by the model in the database 19.

[0087] If the selected domain name belongs to the list of domain names considered infected in the database 19 and the connected device 2 has never accessed this selected domain name, then the method assigns a maximum weight equal to one to the selected domain name. In this case, the score of the connected device 2 is updated and consequently increases. The home gateway 1 repeats the process on the same principle with a new domain name that it selects. The connected device is considered infected when its score becomes higher than a score predetermined by the user.

[0088] If the selected domain name belongs to the list of domain names considered infected in the database 19 and the connected device 2 has already accessed this selected domain name, no weight is assigned, this is equivalent to assigning a weight equal to zero. The score of the connected device 2 is not updated, it remains unchanged. The home gateway 1 starts the process again on the same principle with a new domain name that it selects.

[0089] If the selected domain name belongs to the list of domain names considered uninfected in database 19, no weight is assigned, this is equivalent to assigning a weight equal to zero. The score of the connected device 2 is not updated, it remains unchanged. This is the case whether or not the connected device 2 has accessed the selected domain name. The home gateway 1 then repeats the process on the same principle with a new domain name that it selects.

[0090] If the selected domain name belongs to the historical list of domain names considered infected by the model in the database 19 and the connected device 2 has never accessed this selected domain name, then the method takes into account the weight assigned to the domain name selected in the database. The assigned weight corresponds to the probability of infection of the selected domain name. In this case, the score of the connected device 2 is updated and increases. The home gateway 1 starts the process again on the same principle with a new domain name that it selects. The connected device is considered infected when its score becomes higher than a score predetermined by the user.

[0091] If the selected domain name belongs to the historical list of domain names considered infected by the model in the database 19 and the connected device 2 has already accessed this selected domain name, no weight is assigned, this is equivalent to assigning a weight equal to zero. The score of the connected device 2 is not updated, it remains unchanged. The home gateway 1 restarts the process on the same principle with a new domain name that it selects. If the selected domain name does not belong to the lists of domain names considered infected or not infected, nor to the historical list of domain names considered infected by the model in the database 19, then the process automatically processes the selected domain name via the detection model of the domain generation algorithms.

[0092] First, the method extracts at least one characteristic from the selected domain name. Several characteristics of the selected domain name are extracted.

[0093] Two infection probabilities of the selected domain name are calculated by the model: an infection probability that the domain name was generated by a DGA (first infection probability) and an infection probability that the domain name was generated by an adversarial attack (second infection probability). The model calculates the first infection probability of the selected domain name from the extracted features. Both probabilities are calculated by the model in a manner common to the detection models of domain generation algorithms.

[0094] Two predetermined infection thresholds are then set as needed. Indeed, the higher the predetermined infection threshold, the higher the accuracy but the lower the detection rate, and the lower the predetermined infection threshold, the lower the accuracy (more false positives) but the higher the detection rate. We therefore define a first predetermined infection threshold to detect names generated by DGAs and a second predetermined infection threshold to detect adversary attacks.

[0095] The decision is made based on the first infection probability that predicts the probability of generation by a DGA. If this first infection probability is greater than the first predetermined infection threshold, the domain name is marked as infected, if this first infection probability is less than the first predetermined infection threshold, a second comparison of the second infection probability is made with respect to the second predetermined infection threshold. If the second probability is greater than the second predetermined infection threshold, the domain is marked as infected, if the second probability is less than the second predetermined infection threshold, the domain is marked as not infected. The score of the connected device 2 is calculated in the score accounting system 18 according to the weight assigned to the selected domain name.

[0096] The first probability of infection of the selected domain name corresponds to the weight to be taken into account for the selected domain name when it is higher than the first predetermined infection threshold.

[0097] This first probability of infection is less than one. The score of the connected device 2 is updated, it increases. The probability of infection is between zero and one but more particularly between the first predetermined threshold of infection and one. Indeed, the domain name is considered infected by the model if the probability of infection of said domain name is greater than a predetermined threshold. The weight assigned to the domain name is therefore between the predetermined threshold of infection and one.

[0098] No weight is assigned to the selected domain name if the first infection probability is lower than the first predetermined infection threshold.

[0099] The method updates the score of the connected device 2 after each new domain name processed by the domain generation algorithms detection model and considered to be generated by a DGA.

[0100] The connected device 2 is then considered infected by a domain generation algorithm when the score of said connected device 2 is higher than a predetermined score.

[0101] When the selected domain name is considered to be generated by a DGA by the model, it is recorded in the historical list of domain names considered to be infected by the model in the database as well as the weight corresponding to it. In addition, the connected device 2 is recorded in the list of devices that have already accessed the said selected domain name.

[0102] We will go into more detail about calculating the score of a connected device. The score of connected device 2 is initialized to 50 and the formula for calculating the score of connected device 2 is as follows: score = score + 10 x iteration_decay_f actor 1 x weight

[0103] OR :

[0104] • “i” is the number of times a domain name is marked as a DGA product for the first time, it follows an exponential decay so that the score remains within interpretable standards and avoids its explosion if ever a very large number of DGA domain names are detected,

[0105] • “iteration_decay_factor” is a real number between 0 and 1 that defines the slope of the exponential decay,

[0106] • “weight” is the real number between 0 and 1 which represents the weight of each domain name in the score calculation, it takes into account the prediction probability of each domain name.

[0107] The graph in Figure 4 illustrates the scoring function as a function of the number of detections of domain names generated by DGAs for an iteration_decay_factor of 0.83 and weights that vary between 0.7 and 1 for fifty detections. From the sixth detection, the score already exceeds 80.

[0108] The predetermined score is defined according to the vulnerability and risks to which each client is exposed:

[0109] • a predetermined score of 70 allows an alert to be launched as soon as the fourth detection of domain names generated by DGA,

[0110] • a predetermined score of 90 allows an alert to be launched from the eleventh detection of domain names generated by DGA,

[0111] • a predetermined score of 98 allows an alert to be launched as soon as the fortieth detection of domain names generated by DGA.

[0112] If the score becomes higher than the predetermined score, device 2 is marked as infected and an alert is sent to the user.

[0113] A second possible approach is to send multiple alerts based on the predetermined score. A warning is sent when a predetermined score is reached, then an alert is sent when a second predetermined score is reached, and finally a critical alert is sent to the user when a third predetermined score is reached.

[0114] Typically at least one of the means of the device according to the invention previously described, preferably each of the means of the device according to the invention previously described are technical means.

[0115] Typically, each of the means of the device according to the invention previously described may comprise at least one computer, a central or calculation unit, an analog electronic circuit (preferably dedicated), a digital electronic circuit (preferably dedicated), and / or a microprocessor (preferably dedicated), and / or software means. Of course, the invention is not limited to the examples which have just been described and numerous adjustments can be made to these examples without departing from the scope of the invention.

[0116] Of course, the various features, forms, variants and embodiments of the invention may be combined with each other in various combinations provided that they are not incompatible or mutually exclusive. In particular, all the variants and embodiments described above may be combined with each other.

Claims

DEMANDS 1. A method for detecting machines infected by domain generation algorithms (DGAs) from a home gateway (1) connected to a local network, at least one device (2) being connected to the home gateway (1) via the local network, characterized in that the home gateway (1) comprises a database (19), the database (19) comprising a list of infected domain names, the method comprising the following steps: - monitoring domain name traffic on the local network, - selecting a domain name from domain name traffic, - if the selected domain name is included in said list, the list being included in the database (19), a maximum weight is assigned to said selected domain name, - if the selected domain name is not included in the database (19), automatic processing of the selected domain name by a model (5) for detecting domain generation algorithms: the model assigns a weight to the selected domain name corresponding to a probability of infection only if the selected domain name is recognized as infected by the model, - Calculation of a score for at least one connected device based on the weight assigned to the selected domain name, - updating the score of at least one connected device (2) based on the domain names processed by the model (5), at least one device (2) being considered infected by a domain generation algorithm when the score of said connected device is greater than a predetermined score.

2. A detection method according to claim 1, characterized in that the automatic processing of the domain name selected by the model comprises the following steps: - Extraction of at least one characteristic of the selected domain name, - Calculation of a probability of infection of the selected domain name from at least one extracted characteristic.

3. A detection method according to any one of the preceding claims, characterized in that the database (19) also comprises: - a list of devices that have already accessed the selected domain name, - a list of domain names considered to be uninfected, - a historical list of domain names considered to be infected by the model.

4. A detection method according to claim 3, characterized in that the selected domain name is not included in the database (19) if: - the selected domain name is not considered infected in the database (19), - the domain name does not belong to the list of domain names considered uninfected and already checked in the database (19), - the domain name does not belong to the historical list of domain names considered to be infected by the pattern in the database (19).

5. A detection method according to any one of the preceding claims, characterized in that the score of at least one connected device is initialized to 50.

6. A detection method according to any one of the preceding claims, characterized in that the selected domain name is marked as a product of domain generation algorithms if the probability of infection of said selected domain name is greater than a predetermined infection threshold.

7. Detection method according to claim 6, characterized in that the selected domain name is recorded in the database (19) as well as its weight when it is marked as a product of domain generation algorithms.

8. A detection method according to any one of the preceding claims, characterized in that a second probability of infection is calculated during the automatic processing of the domain name selected by a model (5) for detecting domain generation algorithms, the second probability of infection corresponding to the probability of infection by an adversary attack.

9. A detection method according to claim 8, characterized in that if the probability of infection of said selected domain name is less than a predetermined infection threshold, the second probability of infection is compared to a second predetermined infection threshold: - if the second probability of infection is higher than the second predetermined infection threshold, the selected domain name is marked as an adversarial attack, - if the second probability of infection is less than the second predetermined infection threshold, the selected domain name is not marked as an adversarial attack.

10. A detection method according to any one of the preceding claims, characterized in that an alert is sent to the user by the home gateway (1) when at least one connected device (2) is considered to be infected by a domain generation algorithm.

11. A detection method according to any one of the preceding claims, characterized in that a performance level of the model (5) is calculated via a monitor component (11), the model (5) being updated if the performance level is lower than a predetermined performance level.

12. A detection method according to any one of the preceding claims, characterized in that the detection model (5) of the domain generation algorithms is updated in a remote server (12) to which the home gateway is connected.

13. Home gateway for detecting infected machines by domain generation algorithms, the gateway being equipped with a processing unit for implementing the steps of the process according to claims 1 to 12.

14. Product computer program comprising instructions which, when the program is executed by a computer, cause the computer to carry out the steps of the process according to any one of claims 1 to 12.

Images